Message Inspection Slider VS. Settings

Products

• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention
• Data Loss Prevention Cloud Package
• Data Loss Prevention Core Package
• Data Loss Prevention Enforce
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Network Email
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Network Web
• Data Loss Prevention Plus Suite

Issue/Introduction

What are the differences between the Message Inspection Slider VS Settings?

The message inspection slider only allows movement when the resources are available to move to each selection depending upon file size, number of chains, and amount of memory available. 

Environment

Release : DLP 15.8 & DLP 16.0

Resolution

  To adjust the content inspection size, configure a detection server using the Enforce Server administration console at
System > Servers and Detectors > Overview > Configure Server, and select the Detection tab. You can move the
slider on the Detection tab to the desired content inspection size. Depending on the content inspection size you choose,
certain advanced settings are automatically adjusted.
  In addition to moving the slider to tune your server settings automatically, you need to edit Enforce Server properties
files to enable viewing of incident data (matches) for larger files. You also may need to adjust your system memory.
  For Discover servers with content inspection sizes of 500 MB and greater, you need to edit properties files and follow the
Discover tuning guidelines. The actions you take depend on your Data Loss Prevention deployment

The slider is another way to adjust settings they work in conjunction with one another. Settings after adjusting the slider indicate what is currently set, and going into settings allows you to finely tune file inspection sizes. Resources will need to be in place for any setting changes made, or it will cause a problem with file inspection.

• Note:
  • The last used setting adjustment slider vs settings will override the previous setting.
    • If the "slider" was last used it would override the settings previously set.
      • The slider really just makes automatic settings changes to the allowable resources you have available. And the 2 ways work together.
    • If the "setting" was last used it would override the slider settings. The slider really just makes automatic settings changes to the allowable resources you have available. And the 2 ways work together.
      • If the resources are not available you can break detection/message inspection by adjusting the settings beyond what resources are available for use.
  • By increasing the inspection size you will also be increasing the time to inspect the content.

Additional Information

Please see the tuning guide:

• Symantec™ Data Loss Prevention Tuning Guidelines for Inspecting Large Files 
• Increasing the inspection content size

Size limitations as outlined in these documents:

• Guidelines for tuning Symantec Data Loss Prevention to scan large files
• What is minimum or maximum Size for File for DLP CDS servers